The bigops-procedure-player package (npm ecosystem) at version 35.8.2 includes a malicious loader in index.js that reconstructs delivery hostnames at runtime to fetch OS-specific binaries via HTTPS. If the direct fetch fails, it falls back to assembling the payload from base64 chunks stored in DNS TXT records under *.dl.wel1.ru. The payload is written to temporary files on Unix or Windows systems with executable permissions and launched detached from the main process. The filenames are crafted to resemble system cache or diagnostic artifacts. A similar dropper pattern exists in lib/telemetry.js but is not invoked in this version. The delivery hosts are unrelated to the package publisher, indicating a supply chain compromise or malicious package insertion.

This malicious code enables arbitrary code execution on affected systems by downloading and running OS-specific binaries from attacker-controlled infrastructure. The execution of these binaries under the guise of system cache or diagnostic files can lead to system compromise, persistence, and potential further malicious activity. Because the payload is fetched dynamically and can be assembled from DNS records, it may evade some network detection mechanisms.

No official patch or remediation guidance is currently available. Users should immediately avoid using bigops-procedure-player version 35.8.2 and remove it from their environments. Monitor for any suspicious processes or files matching the described patterns (e.g., temporary files named like system cache or diagnostic artifacts in /var/tmp or %TEMP%). Check for updates or advisories from the package publisher or npm registry. Consider using package integrity verification and supply chain security tools to prevent installation of malicious packages.